mirror of
https://github.com/bytedance/deer-flow.git
synced 2026-04-30 22:08:26 +00:00
7ce9333200
Pass user_id=get_effective_user_id() at every callsite that invokes Paths methods or memory functions, enabling per-user filesystem isolation throughout the harness and app layers. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
30 lines
1006 B
Python
30 lines
1006 B
Python
"""Shared path resolution for thread virtual paths (e.g. mnt/user-data/outputs/...)."""
|
|
|
|
from pathlib import Path
|
|
|
|
from fastapi import HTTPException
|
|
|
|
from deerflow.config.paths import get_paths
|
|
from deerflow.runtime.user_context import get_effective_user_id
|
|
|
|
|
|
def resolve_thread_virtual_path(thread_id: str, virtual_path: str) -> Path:
|
|
"""Resolve a virtual path to the actual filesystem path under thread user-data.
|
|
|
|
Args:
|
|
thread_id: The thread ID.
|
|
virtual_path: The virtual path as seen inside the sandbox
|
|
(e.g., /mnt/user-data/outputs/file.txt).
|
|
|
|
Returns:
|
|
The resolved filesystem path.
|
|
|
|
Raises:
|
|
HTTPException: If the path is invalid or outside allowed directories.
|
|
"""
|
|
try:
|
|
return get_paths().resolve_virtual_path(thread_id, virtual_path, user_id=get_effective_user_id())
|
|
except ValueError as e:
|
|
status = 403 if "traversal" in str(e) else 400
|
|
raise HTTPException(status_code=status, detail=str(e))
|